ASOS Warns Customer Accounts Were Accessed Using Compromised Login Credentials

ASOS US Sales LLC reported unauthorized access to customer accounts using credentials obtained from outside the company, detected on July 28 and confirmed the next day.

In a breach notification dated August 21, 2026, ASOS said it identified unusual activity involving customer accounts and launched an investigation immediately.

The retailer determined that an unauthorized third party may have used externally sourced credentials to sign in to affected accounts. The wording indicates a credential-stuffing or account-takeover scenario rather than a direct compromise of ASOS authentication infrastructure.

In such attacks, threat actors test previously leaked username-password pairs against other online services, relying on customers who reuse passwords across multiple platforms.

ASOS Warns of Customer Account Access

ASOS said the potentially exposed account information may include customer names, email addresses, delivery or billing addresses, telephone numbers, dates of birth, and details of linked social media accounts. The company said social media login credentials were not involved.

The accessed data may also include redacted payment card information, such as the cardholder name, the last 4 digits of the card, and its expiration date.

ASOS did not state that full payment-card numbers, CVV codes, or ASOS account passwords were exposed in the incident. On July 29, 2026, ASOS blocked access to the affected accounts and enforced mandatory password resets.

The company emailed customers on July 30, informing them that they would need to create new passwords before regaining access.
ASOS added that a small number of accounts showed evidence of suspicious transactions.

According to ASOS US Sales LLC, the transactions were blocked by security controls or canceled by its fraud team, with no further unauthorized activity detected after containment measures.

The incident highlights the continuing risk posed by password reuse. Even when a retailer does not suffer a direct data breach, credentials stolen from another service can enable attackers to access accounts containing personal information, addresses, and partial payment information.

Affected users should reset their ASOS password and avoid reusing it on other websites. Customers who used the same password on other services should change those passwords as well, starting with email accounts, banking services, payment platforms, and social media accounts.

Enabling multi-factor authentication where available can further reduce the likelihood of account takeover. ASOS also urged affected individuals to monitor payment account activity and statements for any unfamiliar transactions.

Customers can obtain free annual credit reports through the three major US credit reporting agencies: Equifax, Experian, and TransUnion. They may also consider placing a fraud alert or credit freeze on their credit files if they suspect identity misuse. The notification states that the company’s notice to California residents was not delayed by law enforcement.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC